Analysis
- max time kernel
120s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 03:41
Behavioral task
behavioral1
Sample
2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260716-d8tncscv2q
- SHA256 050db37bdf9f2ca841e849ab0b4a06fbab3e8f8cb78b35a97f7c78aca720e7fb
- MD5 d3cf2498f99ad142d976ca0bb70147e6
- SHA1 19658a0d95487212b682d859a88ceab99c327c4d
- SHA512 8c597b490259b6dce152d71f0da60d045229923af202276c16d0000166e60a0197f33eb12476412086298c5f78aaef02d904fc45364b49288d07fb508e2e5303
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0iK3f3mnXoZ643mnXoZ6i6cMJliQ:A3k03kHRJg3k03kHRJF
- TLSH T10095AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/2004-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c32b-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2bc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2004-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4228-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b96-634.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019fd8-750.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001abb2-1018.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cc8-1261.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c32b-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2bc-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019b96-634.dat aspack_v212_v242 behavioral2/files/0x0003000000019fd8-750.dat aspack_v212_v242 behavioral2/files/0x000700000001abb2-1018.dat aspack_v212_v242 behavioral2/files/0x0003000000019cc8-1261.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4228 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{DAE0785A-A0D2-4C59-964C-79D844ED93C1}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2004 2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4228 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_d3cf2498f99ad142d976ca0bb70147e6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2004
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4228
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 050db37bdf9f2ca841e849ab0b4a06fbab3e8f8cb78b35a97f7c78aca720e7fb
- MD5 d3cf2498f99ad142d976ca0bb70147e6
- SHA1 19658a0d95487212b682d859a88ceab99c327c4d
- SHA512 8c597b490259b6dce152d71f0da60d045229923af202276c16d0000166e60a0197f33eb12476412086298c5f78aaef02d904fc45364b49288d07fb508e2e5303
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0iK3f3mnXoZ643mnXoZ6i6cMJliQ:A3k03kHRJg3k03kHRJF
- TLSH T10095AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 bdc663bd1c7f196c612ae3b100c4182baad5c7fde71c882f83265a2d42bdae78
- MD5 92d3681e324a7c089416e67a42f99093
- SHA1 4842becfa82f190509283360cc592219d876949c
- SHA512 3cdb591d775c75e273ea0821482eaec762829f2f3a8c4c52cf369cc34f0cc0c2975e8bfe676576178ee7944c8c71a261d5038bb7fd679e23211512b029b77504
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0iK3f3mnXoZ643mnXoZ6i6cMJliU:A3k03kHRJg3k03kHRJBPji0Aj
- TLSH T1B5C59D17FAA401B5D026C174CAD69666FA7178461B30D7CF2358C6282F63BD0AB3E3B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
- Size 1.9MB
- SHA256 44c445d0a20a5eba31f13bad2ebc5c06fd960c51c3643429e3cd370d3a1c73a9
- MD5 39a9b187841d757bdbbf721073de7088
- SHA1 a78144a06083675c508c047e713881e94ec4e4f2
- SHA512 61e9f23b0a1ba7a72d7d29ebdccea02c72db7af17336470e4e18528b9764d587630614bf98b05d98acf3d9bc62ac5fac6835d3fcc2a3f939efd80415f508c81e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0iK3f3mnXoZ643mnXoZ6i6cMJliR:A3k03kHRJg3k03kHRJa
- TLSH T12895AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 3.8MB
- SHA256 e5bc58b1b3bbd6235b2ea14cd610234e99be6f8c248d524c83f7e42ec95b7cdf
- MD5 0c7c3c698491273ba31a14544a9228b1
- SHA1 4713e494a69f7623cdc437676ac9a6b1d8b519dc
- SHA512 ce8025c6dfd2eb9cd5ca5fa9e3a744862a2f2d416c51ef3455242265682eff6a772e09e561866e3937bb995cb1d87df97c0e7c6f0abeb3829e0560fa59b5981c
- SSDEEP 98304:A3k03kHRK3k03kHRK3k03kHRK3k03kHRY:A3k03kH83k03kH83k03kH83k03kHu
- TLSH T17A06AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE
- Size 1.9MB
- SHA256 7662456a028309de9f406de7e3e7b334d5d26f96cf9a8842e08a60e7f525c98c
- MD5 7af0a7e61417c0523017f0ec764d0ee0
- SHA1 bdfc1adeac3f8755ff3c8e4f83ecd882de680aaf
- SHA512 129d11ed9e234d3a1835bbfb7cc7fbd4dc059aa1f0ba44fb98753c18bb0e8e373d941d38bd795c3afb0b6e3aa6621d39975be2fc04fb9c9f842ca1d950fe3fa6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0iK3f3mnXoZ643mnXoZ6i6cMJlid:A3k03kHRJg3k03kHRJu
- TLSH T15295AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 2.0MB
- SHA256 17f3c79b41c2ea5f3246d0cbee87ddabf115daa3b2f157b01b5226c3770a395c
- MD5 1b2a7dcaeff1207f7035e1b85f785dd9
- SHA1 237ee479b91f4320de0590a4ac81ec29a58ecc36
- SHA512 3b22321cd4d9921e18ef1f39658483dece7c02b4af1a3a5250c3cbfcdff5501ac8865f29fa68f882fde0adeabaa21c80b28836330c02dbeb14e0f3ca6bf430e9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0iK3f3mnXoZ643mnXoZ6i6cMJliI:A3k03kHRJg3k03kHRJj
- TLSH T1DDA5AE03E6D504E5D54A81709ADA8A22FA75BD52176093EF2358F3152F72BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH